Malware Uses Panel of AI Models to Decide on Attack Actions

A Windows implant named CLOSEDQUORUM has been disclosed by Cisco Talos, which is unique in that it removes human attackers from the decision-making loop. The malware uses a panel of four commercial large language models - DeepSeek, Qwen, Mistral, and Google Gemini - to vote on which attack action to take next.

The architecture of CLOSEDQUORUM allows it to be structurally resistant to AI safety guardrails, as the refusal of one model's decision cannot stop the attack if the other three agree. This means that even if one provider declines a prompt on safety grounds, the implant can still proceed with a majority vote.

When deployed, CLOSEDQUORUM runs a reconnaissance pass to gather information about the host system and then dispatches a structured prompt to each of the four configured AI providers in sequence. The models receive the same prompt and must respond with a typed JSON object specifying one of four actions: steal, inject, persist, or move.

The ModelOrchestrator component tallies the votes through an interModelDiscussion() function and selects the action with the most votes. If all four providers fail or hit guardrails, the implant defaults to a sleep-and-retry loop.